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IN THE UNITED STATES DISTRICT COURT 
FOR THE SOUTHERN DISTRICT OF TEXAS 


HOUSTON DIVISION 
TIMOTHY MCKIMMY § 
Plaintiff, § 
§ 
V. § CIVIL ACTION NO. 4:22-cv-00545 
§ 
OPENSEA § 
Defendant. § JURY TRIAL DEMANDED 


PLAINTIFF’S ORIGINAL COMPLAINT 


TO THE HONORABLE JUDGE OF THIS COURT: 

COMES NOW, Plaintiff Timoty McKimmy, who files this Original Complaint against 
Defendant OpenSea, and for cause of action, respectfully shows this Court the following: 

JURISDICTION AND VENUE 

1. The Court has jurisdiction over the lawsuit pursuant to 28 U.S.C. 1332, because the 
parties are diverse in citizenship and the amount in controversy exceeds $75,000. 

2 Venue is proper in this district because Defendant does substantial business in this 
district, through its online platform. This is also the district Plaintiff was in at the time he 


purchased the NFT at issue. 


PARTIES 
3. Plaintiff Timothy McKimmy is an individual living in Texas. 
4. Defendant OpenSea is a foreign corporation headquartered in New York. 


Defendant may be served via certified mail, return receipt requested, to its headquarters at 105 E. 


24th St #4D, New York, NY 10010. 
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FACTUAL BACKGROUND 

=A Defendant OpenSea is the principal non-fungible token (“NFT”) marketplace. It is 
widely referred to as the “eBay of NFTs.” 

6. In only four years of existence, Defendant has handled over $11 billion in sales to 
date, including the sale of a Bored Ape Yacht Club NFT for $3 million. The Information reported 
OpenSea was recently fielding new investment offers that valued the company at $10 billion. 
Other outlets reported the valuation at close to $13 billion. 

ve To use OpenSea, users must connect crypto wallets to OpenSea. Defendant was 
aware of security vulnerabilities in its platform. Despite having full knowledge of these security 
issues, Defendant did not properly inform its users and did not timely put adequate safety measures 
in place. 

8. Instead of shutting down its platform to address and rectify these security issues, 
Defendant continued to operate. Defendant risked the security of its users’ NFTs and digital vaults 
to continue collecting 2.5% of every transaction uninterrupted. 

9. The Bored Ape Yacht Club consists of 10,000 unique NFTs. The current price of 
entry, for the lowest valued Bored Ape, is 98 ETH, or $307,564 USD. Ownership of a Bored Ape 
NFT gives an individual access to the Yacht Club, which contains numerous members-only 
benefits. One of those benefits is the ability to converse with other Yacht Club members. Owners 
of Bored Ape NFTs include: current NBA stars Stephen Curry and LaMelo Ball; NBA Hall of 
Famer Shaquille O’Neal; soccer star Neymar; Dallas Mavericks’ owner Mark Cuban; tennis great 
Serena Williams; comedian Kevin Hart; music artists such as Justin Bieber, Future, Lil Baby, Post 


Malone, Steve Aoki, and Eminem; and numerous other individual investors. 
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10. ‘Plaintiff is the rightful owner of Bored Ape #3475. On or about February 7, 2022, 
Plaintiff's Bored Ape was stolen, listed, and sold to another individual on Defendant’s platform. 
Plaintiff did not list his Bored Ape for sale on the marketplace. Defendant’s security vulnerability 
allowed an outside party to illegally enter through OpenSea’s code and access Plaintiff’s NFT 
wallet, in order to list and sell Plaintiff's Bored Ape at a literal fraction of the value (at .01 ETH). 
Essentially, OpenSea’s vulnerabilities allowed others to enter through its code and force the listing 
of an NFT. This is through no fault of the owner. 

11. — After this forced entry through OpenSea code, and immediate purchase/sale, it was 
then immediately resold at 99 ETH, which is still vastly below value, based on the rarity of the 
Bored Ape. 

12, The “purchase” or “sale” of Plaintiff's Bored Ape was reported by numerous social 
media accounts, due to its egregiousness. Twitter user @boredapebot reported “Bored Ape #3475 
was purchased for 0.01 WETH.” 

13. Prior to the filing of this lawsuit, Plaintiff attempted to resolve the issue numerous 
times with Defendant. Defendant ignored Plaintiff. Defendant claimed to be “actively 
investigating” the issue, yet as of the filing of this Complaint, Defendant has failed to reverse the 
transaction, return the Bored Ape, and/or provide any adequate remedy. 

14. Plaintiff also attempted to resolve the issue with the individual who currently 
possesses Plaintiff's Bored Ape. The individual refused to return it. 

15. Plaintiff's Bored Ape has significant value; this is unquestionable. For example, 
Justin Bieber purchased Bored Ape #3001 for 500 ETH, or $1.3 million at the time of the 
transaction. Bieber’s Bored Ape has a rarity score of only 53.66 and a rarity rank of #9777. In 


contrast, Plaintiff's Bored Ape has a rarity score of 138.52 and a rarity rank of #1392. It is in the 
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top 14% rarity, and it is significantly rarer than Bieber’s. Thus, Plaintiff’s Bored Ape’s value is 
arguably in the millions of dollars and growing as each day passes. 

16. Plaintiff brings this lawsuit to protect the interests of NFT owners, who reside in 
countries worldwide and use Defendant’s platform. Plaintiff brings this lawsuit to force Defendant 
to enact sufficient security measures and address the known susceptibilities in its interface. 

17. | NFT forums have discussed instances in which Defendant has approached other 
victims with an NDA and offering the base floor price, regardless of the rarity of the specific NFT 
that was stolen. In this instance, Defendant has not approached Plaintiff with any solution. 

18. _Defendant’s platform is no stranger to controversy. On its Twitter account on 
January 27, 2022, Defendant revealed over 80% of items created with its minting tool were 
“plagiarized works, fake collections, and spam.” This is in addition to numerous reports of security 
breaches. In September 2021, Defendant admitted insider trading of NFTs it promoted. 
Defendant’s own executive, who was Head of Product, used inside knowledge to buy NFTs before 
they were promoted on the website. 

19. Defendant’s actions were a proximate cause of Plaintiffs injuries. Had it not been 
for Defendant’s actions and inactions, Plaintiff would not have suffered damages. 

CAUSES OF ACTION 
NEGLIGENCE 

20. Plaintiff re-alleges each aforementioned allegation as if it is fully incorporated 
below. 

vAG Defendant owed a duty of reasonable care of Plaintiff. Defendant breached this 
duty in several ways, including, but not limited to, the following: 


a) Failing to exercise reasonable care; 
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b) Failing to take proper measures to protect users; 

c) Failing to use reasonable security systems and networks; 

d) Failing to institute safety protocols; 

e) Failing to address vulnerabilities it knew or should have known of; 

f) Failing to properly secure; 

g) Failing to properly safeguard; 

h) Failing to implement processes by which they could timely detect, address 
and/or remediate security breaches. 


BREACH OF FIDUCIARY DUTY, TRUST, CONTRACT AND IMPLIED CONTRACT 





22. Plaintiff re-alleges each aforementioned allegation as if it is fully incorporated 
below. 

23. Defendant breached its fiduciary duty owed to Plaintiff by failing to implement 
policies and procedures to prevent, identify, detect, respond to, mitigate, contain, and/or correct 
security violations. 

24. Defendant failed to protect the integrity of its systems and failed to timely notify 
and/or warn Plaintiff and others of the extent and severity of vulnerabilities in its code. 

25. Defendant failed to protect against reasonably-anticipated threats or hazards to the 
security or integrity of its code and systems. 

26. By entering into contracts and/or implied contracts with Defendant, users expected 
Defendant’s security practices to comply with laws and regulations. Users like Plaintiff also 


expected Defendant to reasonably protect wallets which were connected to its platform. 
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PRESERVATION NOTICE 
27. Plaintiff hereby requests and demands that Defendant and its agents, attorneys, and 
insurers preserve and maintain all evidence pertaining to any claim or defense to the incident made 
the basis of this lawsuit, or the damages resulting therefrom, including but not limited to: any 
internal communications discussing security issues; memoranda; files; e-mails; text messages; 
investigation reports; reports of prior hacks; and any other data or information related to the 
referenced incident. Failure to maintain such items will constitute a “spoliation” of the evidence. 
JURY DEMAND 
28. Plaintiff demands a jury trial and hereby tenders the jury fee. 
DAMAGES 
29. Plaintiff seeks damages for the loss of the Bored Ape. Plaintiff seeks any and all 
damages to which he may be entitled, including the return of the Bored Ape, damages equivalent 
to the valuation of the Bored Ape, and/or monetary damages over $1,000,000. Plaintiff seeks 
attorneys’ fees, costs, expenses, pre and post judgment interest, and injunctive relief requiring 
Defendant to pause and/or stop any listing or sale of the Bored Ape in question. 
PRAYER 
30. For these reasons, Plaintiff asks that Defendant be cited to appear and answer this 
suit. Plaintiff prays for any and all other relief to which he may be justly entitled. 
Respectfully, 
DALY & BLACK, P.C. 
/s/ Andrew Dao 
Andrew Dao 
Federal I.D. No. 2368172 
Texas Bar No. 24082895 


2211 Norfolk St., Ste. 800 
Houston, Texas 77098 
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(713) 655-1405 

(713) 655-1587 (fax) 
adao@dalyblack.com 
ecfs@dalyblack.com (service) 


and 


TADGHIGHI LAW GROUP 


Ash Tadghighi 

State Bar No. 24090418 
711 Reinicke St. 
Houston, Texas 77007 
Tel: (832) 930-1135 
Fax: (713) 583-0095 
ash@tadghighilaw.com 


ATTORNEYS FOR PLAINTIFF 


